Privacy policy
Last updated 25 September 2026
FounderPipe is a CRM run by Northvale Technologies Ltd, a UK company ("we", "us"). This policy explains what personal data FounderPipe holds, why, who helps us process it, and the rights you have under UK data protection law (the UK GDPR and the Data Protection Act 2018).
Questions or requests: [email protected].
Two kinds of data, two roles
Your account. When you sign up we hold your name, email address, a hash of your password (never the password itself), your business and workspace names, and the security settings you choose, such as two-factor authentication. For this data we are the controller.
What you put in the CRM. The contacts, companies, deals, notes, tasks, workbooks and sequences you create or import, the emails you send from FounderPipe, and the replies and copies of mail that come back to it. This is mostly other people's personal data, your leads', and you decide what goes in and why. For this data you are the controller and we are your processor: we store and process it only to run FounderPipe for you, following your instructions, and never sell it or use it for anything of our own.
If you are someone whose details a FounderPipe customer holds, your first port of call is that customer. If you write to us instead, we will pass your request on to them. Every sequence email carries an unsubscribe link, and using it stops FounderPipe emailing you on that customer's behalf.
Why we use your account data
- To provide FounderPipe (performance of our contract with you): signing you in, keeping your account and team working, sending the emails the service needs, such as confirming your address, resetting a password or inviting a teammate.
- To keep it secure and working (our legitimate interests): logs of requests and errors, rate limits on sending, and protection against abuse.
- To meet legal obligations, where the law requires us to keep or disclose something.
We do not use your data, or your CRM's, for advertising, and we do not sell it.
Who helps us: sub-processors
These services process personal data for us. Each is bound by a contract that limits it to doing so on our behalf.
| Provider | What for | Where |
|---|---|---|
| DigitalOcean, LLC | Hosting the app and its database. Everything in your account and CRM is stored here. | London, UK |
| Resend | Sending email (sign-up, invitations, emails and sequences you send to contacts) and receiving replies and mail you copy to your workspace's logging address. | USA, sending from the EU |
| Anthropic, PBC | Only for workspaces whose owner switches on "Sort replies with AI" or "Draft emails with AI". Sorting sends a lead's reply, the email of yours it answers, and the lead's name and company to Anthropic's Claude model, which suggests what to do next. Drafting, each time someone asks for a draft, sends the workspace's product brief and the contact's name, job title, company, notes and recent timeline, from which Claude writes an email for them to edit and send. Under Anthropic's commercial terms, data sent through its API is not used to train its models. Both are off by default; nothing is sent while they are off. | USA |
| Google LLC (Google Fonts) | Serving the typeface the site uses. Your browser fetches it from Google, which sees your IP address and browser details, but no account or CRM data. | USA |
Where data leaves the UK, it is protected by the safeguards UK law requires, such as the UK International Data Transfer Agreement or Addendum, or the UK Extension to the EU-US Data Privacy Framework. We will update this list before adding a new sub-processor.
Cookies
FounderPipe sets only the cookies it needs to work: one that keeps you signed in, and ones that protect forms against cross-site request forgery. There are no analytics, tracking or advertising cookies, so there is nothing to consent to beyond using the site.
How long we keep data
Account and CRM data is kept while your account is open. Archiving a contact or company keeps it (that is the point of archiving); deleting removes it. When you close your account, we delete its data from the live database within 30 days; copies in backups are overwritten on the backup provider's normal cycle. Records we must keep by law are kept for as long as the law says.
Your rights
You can ask for a copy of your personal data, and have it corrected, deleted, restricted, or sent to you in a portable form. You can object to processing we do for our legitimate interests. You can download your own account data and delete your login under Account settings; for anything else, or to close a whole account, email [email protected]. We will answer within one month.
If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk. We would appreciate the chance to put it right first.
Security
Traffic to FounderPipe is encrypted (HTTPS), passwords are stored only as salted hashes, two-factor authentication is available, and every database query is confined to the account making it, so one account can never see another's data.
Changes
When this policy changes, the date at the top changes too. If a change matters to how your data is used, we will tell account owners by email before it takes effect.